Compliance Online
POPI Act
Compliance Training.
Done Right.
Simple. Flexible. Cost-effective.
Who are we?
We have more than 21 years’ experience
We focus on legal compliance training
We have trained more than 120 000 trainees
We have rolled out more than 200 000 training units
We have more than 80 localised programmes
What do we offer?
We are a specialist provider of legal and regulatory compliance training solutions to private and public sector entities.
We assist with the design and development of customisable online training programmes and a range of awareness-raising tools.
We have developed technology that caters specifically for the intricacies of online compliance training. Our training platform is state-of-the-art; developed using the latest technology; and specifically designed to eliminate distractions.
POPIA
Protection of Personal Information Act
The Protection of Personal Information Act (POPIA) sets conditions for how your business may process personal information. Our training programmes provide an overview of the rationale for and aims of POPIA.
POPIA has been signed into law and companies are advised to train their employees on the do’s and don’ts of processing personal information. Our training is specifically designed to ensure that institutions and information officers comply with their obligation to conduct internal awareness sessions.
Considering that POPIA covers the processing of employees’ and clients’ information, any breach of the act can have serious repercussions for your human resources department and your business.
Our training programmes demystify the concept of personal information and explain when and how your employees have to comply with POPIA.
Be prepared – contact us to assist you with a proactive approach to raising awareness of POPIA in your business.
Our programmes are CPD accredited.
On completion of our programmes, the trainees will be familiar with:
• POPIA and who must comply with it.
• The meaning of “personal information” in terms of POPIA.
• When information is “processed”.
• The rules they must comply with when processing
information.
• The practical steps your business needs to take to ensure
compliance with POPIA.
• The consequences of non-compliance.
Not sure where to start?
Training Overview
What programmes do we offer?
We offer 4 fully customisable training programmes:
1. POPIA in a Nutshell
2. POPIA: General Awareness
3. POPIA for IT
4. POPIA with reference to the GDPR
1. POPIA in a Nutshell
2. POPIA: General Awareness
3. POPIA for IT
4. POPIA with reference to the GDPR
How many trainees are required to purchase a programme?
Contact us for a training solution that best suits your needs.
What topics do the programmes cover?
Our programmes cover a range of topics - from the basics around what personal information is, to what your compliance obligations are under POPIA.
Contact us for more information regarding our extensive learning outcomes.
Contact us for more information regarding our extensive learning outcomes.
How long does it take to complete our programmes?
Our programme duration times range from 1 to 3 hours.
What is the cost of our training?
Our pricing depends on the number of trainees you enrol.
Contact us for the best pricing solution for you or your company.
Contact us for the best pricing solution for you or your company.
Are our programmes accredited?
Our programmes are CPD accredited by the Compliance Institute of South Africa and the Financial Planning Institute of Southern Africa.
Compliance Online is also accredited with the Services SETA.
Compliance Online is also accredited with the Services SETA.
Clients
Brands we’ve worked with include:
Questions
Frequently asked questions
Here’s a list of popular questions about POPIA. Contact us to enquire about how we can help your company comply.
What is POPIA and why is it important for companies in South Africa?
The Protection of Personal Information Act, or POPIA, is South Africa’s data privacy
law. It sets the rules for how companies gather, use, and share people’s personal
information.
POPIA protects the right to privacy and builds trust in the digital world.
Companies in South Africa must comply with POPIA.
What are the key principles and requirements of POPIA?
POPIA has eight core rules:
● Accountability
● Processing limitation
● Purpose specification
● Further processing limitation
● Information quality
● Openness
● Security safeguards
● Data subject participation
These rules govern how your business deals with personal information.
● Accountability
● Processing limitation
● Purpose specification
● Further processing limitation
● Information quality
● Openness
● Security safeguards
● Data subject participation
These rules govern how your business deals with personal information.
How does POPIA define "personal information"?
Personal information refers to any information that can be used to identify a living
person or an existing business. This includes things like names, contact details, ID
numbers, email addresses, and more.
Extra sensitive personal information, called special personal information, gets special protection under POPIA. Examples include religious beliefs, race, and political views.
Extra sensitive personal information, called special personal information, gets special protection under POPIA. Examples include religious beliefs, race, and political views.
What are the implications of non-compliance with POPIA?
Not complying with POPIA can have serious consequences, such
as
● regulatory fines;
● claims for damages;
● reputational damage;
● loss of customer trust and loyalty;
● imprisonment or fines for individuals; and
● disruptions to company operations.
● regulatory fines;
● claims for damages;
● reputational damage;
● loss of customer trust and loyalty;
● imprisonment or fines for individuals; and
● disruptions to company operations.
What steps should companies take to ensure compliance with POPIA?
To comply with POPIA, companies should
● appoint dedicated compliance leads;
● figure out how information flows through the business;
● review policies;
● get proper consent from customers;
● have valid reasons for using people's information, and more.
● appoint dedicated compliance leads;
● figure out how information flows through the business;
● review policies;
● get proper consent from customers;
● have valid reasons for using people's information, and more.
How can companies protect personal information and prevent data breaches?
To protect personal information, companies should
● classify data sensitivity;
● encrypt sensitive data and control access;
● train employees;
● have audit controls;
● install security tools like firewalls and anti-malware;
and much more.
● classify data sensitivity;
● encrypt sensitive data and control access;
● train employees;
● have audit controls;
● install security tools like firewalls and anti-malware;
and much more.
What are the rights of individuals under POPIA?
People have the right
● to be notified about the collection of their personal information;
● to ask for access to and corrections of their personal information;
● to object to the processing of their personal information; and
● to make complaints to regulators, and be notified about serious data breaches.
● to be notified about the collection of their personal information;
● to ask for access to and corrections of their personal information;
● to object to the processing of their personal information; and
● to make complaints to regulators, and be notified about serious data breaches.
What are the responsibilities of companies in handling and processing personal information?
Companies must
● appoint dedicated compliance leads;
● obtain proper consent from customers when required;
● have valid and lawful reasons for collecting and using personal information;
● gather information directly from the people concerned where possible; and
● only retain personal information as long as necessary for the original purpose.
● appoint dedicated compliance leads;
● obtain proper consent from customers when required;
● have valid and lawful reasons for collecting and using personal information;
● gather information directly from the people concerned where possible; and
● only retain personal information as long as necessary for the original purpose.
What are the consequences of unauthorised access or disclosure of personal information?
Unlawfully accessing or disclosing someone's personal information can lead to legal penalties, lawsuits, criminal charges, business disruptions, damage to reputation, and loss of trade secrets and intellectual property.
How can companies obtain consent for collecting and using personal information?
Consent must be clearly stated, voluntary, specific and informed.
It means that requests for consent must be in plain language, the person must understand what they are giving consent to, and the consent must be actively given (such as by ticking a box).
It means that requests for consent must be in plain language, the person must understand what they are giving consent to, and the consent must be actively given (such as by ticking a box).
What are the requirements for transferring personal information outside of South Africa?
POPIA only allows for the transfer of personal information outside of South Africa if
the other country has adequate legal protection for personal information, or there
are binding corporate rules or a binding agreement that provides the right
protection.
It can also be transferred if the data subject consents to the transfer, or the transfer is necessary to fulfil a contract.
It can also be transferred if the data subject consents to the transfer, or the transfer is necessary to fulfil a contract.
How can companies handle data subject access requests under POPIA?
To properly handle access requests, companies should
● designate a contact point for requests;
● verify individuals' identities before providing any information; and
● respond within 30 days where possible or communicate timelines for more complex requests.
● designate a contact point for requests;
● verify individuals' identities before providing any information; and
● respond within 30 days where possible or communicate timelines for more complex requests.
What are the obligations of data protection officers or designated responsible parties?
Data protection officers and compliance leads must
● advise the business on privacy compliance;
● monitor compliance and conduct audits;
● handle people's requests to access or correct their personal information; and
● act as a contact point for regulators.
● advise the business on privacy compliance;
● monitor compliance and conduct audits;
● handle people's requests to access or correct their personal information; and
● act as a contact point for regulators.
What are the considerations for data retention and data destruction under POPIA?
For retaining information, companies must only keep personal information as long as necessary for the original purpose, define clear retention periods in policies, regularly review and update retention schedules, and get consent for retaining information indefinitely.
A company must not destroy personal information it must retain, and it must destroy the information correctly and securely.
A company must not destroy personal information it must retain, and it must destroy the information correctly and securely.
How should companies handle direct marketing activities under POPIA?
For direct marketing, companies must
● obtain explicit consent for marketing purposes;
● provide easy opt-out methods;
● register opt-outs to avoid contacting people again;
● only use the information for purposes that match what consent was given for;
● be careful not to overstep with contact frequency; and
● exercise caution when marketing to vulnerable groups.
● obtain explicit consent for marketing purposes;
● provide easy opt-out methods;
● register opt-outs to avoid contacting people again;
● only use the information for purposes that match what consent was given for;
● be careful not to overstep with contact frequency; and
● exercise caution when marketing to vulnerable groups.
What are the reporting and notification requirements for data breaches?
For data breaches, companies must
● notify regulators promptly about serious breaches;
● provide details of breaches to regulators;
● notify affected individuals directly in high-risk cases;
● give recommendations to mitigate harm to notified individuals;
● and keep internal records of all breaches that occur.
● notify regulators promptly about serious breaches;
● provide details of breaches to regulators;
● notify affected individuals directly in high-risk cases;
● give recommendations to mitigate harm to notified individuals;
● and keep internal records of all breaches that occur.
What are the steps for conducting privacy impact assessments?
A risk assessment must be done for every processing activity and involve these
steps:
● identify the activity that must comply with POPIA;
● determine who in a company is involved in the activity;
● determine who is responsible for following the POPIA rules; and
● assess the difficulty of enforcing compliance; and
● rate the risk.
● identify the activity that must comply with POPIA;
● determine who in a company is involved in the activity;
● determine who is responsible for following the POPIA rules; and
● assess the difficulty of enforcing compliance; and
● rate the risk.
How can companies develop and implement a POPIA compliance programme?
To develop a POPIA compliance program, companies should:
● demonstrate commitment to POPIA compliance;
● do a risk assessment;
● put policies and procedures in place;
● train their employees;
● monitor and report on their POPIA responsibilities; and
● evaluate and improve their compliance programme.
● demonstrate commitment to POPIA compliance;
● do a risk assessment;
● put policies and procedures in place;
● train their employees;
● monitor and report on their POPIA responsibilities; and
● evaluate and improve their compliance programme.
What are the enforcement measures and penalties for non-compliance with POPIA?
POPIA gives the Information Regulator significant enforcement powers including conducting audits, issuing compliance notices, imposing large administrative fines, pursuing criminal prosecution, and taking civil action in courts.
What are the emerging trends and developments in POPIA compliance?
Key trends in privacy include
●privacy by design;
● ISO 27701 certifications;
● early privacy impact assessments;
● privacy tools and automation;
● improved cross-border data flows;
● revised cookie consent approaches;
● privacy-security alignment;
● regulator cooperation; and
● AI privacy in South Africa.
●privacy by design;
● ISO 27701 certifications;
● early privacy impact assessments;
● privacy tools and automation;
● improved cross-border data flows;
● revised cookie consent approaches;
● privacy-security alignment;
● regulator cooperation; and
● AI privacy in South Africa.
Gallery
What can you expect
Previous
Next
Testimonials
What do our clients say about us
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Ema SmithCEO | Company 
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Ema SmithCEO | Company
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Ema SmithCEO | Company
Previous
Next